I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents

Evidence record

Two controlled studies of forged reasoning text in model and agent contexts.

Read the original source ↗

Claim-level citations (4)

• supportsForged reasoning tags changed model disclosure and agent tool actions: Study 1 recorded 629 disclosure runs among 6,000 synthetic tests; of leaking runs, 67.7% exposed data in the final response alone, 20.8% in reasoning alone and 11.4% in both.

  Study 1 Results: Table II and Location Table III

• supportsForged reasoning tags changed model disclosure and agent tool actions: The paper evaluates both direct private-record leakage and indirect model-specific attacks against tool-using agents.

  Study 1 and Study 2 experimental design

• supportsForged reasoning tags changed model disclosure and agent tool actions: The controlled tests compared tagged and untagged payloads and model-specific reasoning impersonation.

  Study 1 Results and Study 2 Results

• supportsForged reasoning tags changed model disclosure and agent tool actions: In Study 2, MiniMax-M2.5 with own-voice tagged reasoning-style injection achieved 42% reverse-shell and 50% Git backdoor success across 50 trials per condition; the corresponding plain user-style malicious text achieved 0%.

  Study 2 Results: Table IV and evaluation design